Geek asks and answers

Best practice for resetting forgotten user passwords

As far as I can tell, there are two reasonable ways to reset a password forgotten by the user.

  • Enter the user's email address and a new plaintext password will be sent to their email address.

  • The link is sent to their email address with a UID in the URL. By clicking on this, the user receives a form on the website where they can choose their own password.

Which method is preferred and why?

If method 1 is used, perhaps a third party can read the letter and get a new password. If method 2 is used, what does it take for someone to methodically go through the UIDs to try to access the form in order to change the user password?

+5
source share
3 answers

The best template would be:

  • User requests reset password. This is best done through the username and not indicate whether the username exists or not (to avoid a possible list of users through a script)

  • You create an entry in a new database table with the user ID, datetime query (= current time and time) and the newly generated GUID

  • You send an email to the user, pointing to the reset password page with the GUID (and not the user ID) as a parameter

  • On this page, you should verify that a GUID exists, and ultimately you can specify an expiration date (= user has 1 day to reset, for example)

  • "" (   ), reset ,    ...

, , ....

+24

, , .

, .

"" .

Be sure to send the username and password separately.

For an Office 365 user, direct them to my forgotten password area or send this link https://passwordreset.microsoftonline.com

Do not bully the user, escalating into an IT manager if the need arises.

0
source

More articles:


All Articles